Hey everyone just received my proxmark3 today and have already managed to clone a couple lf key fobs when i ran into a hf fob
After doing some research i found it to be a HID IClass 2k Key fob like the image below
I have looked all over these forums and the main idea im getting here is that these are basically impossible to clone however all the examples used had cards instead of fobs so i decided to make an account and test my luck.
Thanks for the responses in advance.
Hi. Welcome!
This is the key fob that my fire department uses for our ambulance. The fob allows us to enter one of the hospitals we transport to. I believe I successfully cloned it to my flexclass. The output from my pm3 shows the same output for both the fob and flexclass. However, I have yet to be successful in getting it to work on the hospital reader. The reader is not even recognizing it. The flexclass, as i have been told, can be tricky to get a good read. I even have trouble getting my pm3 to read it…placement has to be perfect.
Basically, I believe your question is how do you clone it using a pm3? I’ll try to share my steps later tonight when I have access to my computer. Amal did post a how to guide, but it wasn’t as “dummy” proof as I’d like, so I’ve actually been meaning to post my own version of a how-to. Haven’t done it yet, since I never actually confirmed my flexclass worked on a reader, but I’ll share it with you and if you could confirm that my steps work, then we will be good to go 
.
Edit: in meantime, here is the guide that amal created:
Oh thanks so much thats really helpful ill make sure to check it out and try follow your steps. Also when you say its never properly worked do you happen to know the reason? From what ive seen a lot of people say some of the blocks are encrypted which makes it impossible to change
Hey just realised what the flexclass is, I didn’t fully realise for some reason that it was an actual implant which sounds insanely cool however since I’m just getting started I’d probably be looking at cloning it to another cheap fob or something.
Sorry for the multiple replies, after some more research it’s looking more and more possible but I wanted to know what kind of blank I should buy to clone it onto, I’ve seen some people recommend buying blank hid iclass card but I don’t know if I’d be able to clone the data from a fob to a card. So I guess my question is would a blank hid iclass card work with my hid iclass fob?
It should. I believe the difference between a fob and card is the antenna. The chips in both should be the same.
Oooh sounds good, what I’ve seen being recommended is the red team Blank iCLASS 2K RFID Card however those are out of stock, I live in Australia so I’m not sure where else I can find something like that.
Where in Aus? I am in Brisbane.
I usually try AliExpress as it is usually cheaper, otherwise Amazon or occasionally eBay.
I don’t have any iclass readers so I have never brought any of the cards, so not sure how scarce they are.
I just looked on all three. Only found them on eBay searching for iclass 2k. Read and writeable cards are 14.95AU; one seller claims to be in Brighton Australia so you may get a fairly quick delivery.
Im from Sydney so yeah that sounds perfect, I think I found the listing you’re talking about, is it the HID ICLASS Legacy card? Would that work thr same?
Looking at the red team card and the eBay posting, the legacy seems the same…but it’s eBay so it is possible its wrongly described.
Well I guess we’ll find out in 4-10 days since that’s how long delivery takes, thanks so much for your help I’ll try keep this thread updated
Wanted to say I also bought the blue key fob from ebay managed to get one for around 18 aud so I’ll be testing that aswell
A legacy blank iClass card should do the trick. If it’s a PicoPass 2k, I think you should be all set. That’s essentially what the flexClass is.
The process is pretty much identical for the cards and the fobs…other than placement. I used my PM3 RDV2 and didn’t have any coupling issues, but I have read that others have had issues. Read up, as I hope your adventures with this is WAY easier and less stressful than mine was in the beginning 
Hey just got the stuff i ordered this will be my first time cloning a hf tag can you run me through the process real quick?
Im trying to simply dump from one token to another but when i run the command hf iclass dump it gives me [-] run command with keys
Hey guys this is my second post about this topic, im trying to clone a HID Iclass 2k tag to another tag. I have purchased a non-programmed one and it has arrived.
I tried to simply dump and restore using this post Cloning an HID iClass credential to your flexClass
however when i type in hf ic --ki 0 i get this error
To rule out the easy stuff,
what version is your pm3? Latest Version?
can you do a simple hf search and detect the fob?
